How to Install an SSL Certificate on Joomla and Force HTTPS

Moving a Joomla site to HTTPS takes three steps: install an SSL certificate on your server, set Force HTTPS in Joomla’s Global Configuration, and add a 301 redirect so old HTTP links follow. The third step has a Joomla-specific catch that trips up most people, and it is covered below before the code.

Quick answer: install the certificate through your hosting panel, then go to System > Global Configuration > Server and set Force HTTPS to Entire Site. To add a redirect at server level, first rename htaccess.txt in your Joomla root to .htaccess, because Apache ignores the file under its shipped name.

SSL (short for Secure Sockets Layer, though every certificate issued today uses TLS) is what removes the “Not Secure” label from your address bar. If you want the background first, read what an SSL certificate is. These steps apply to Joomla 5 and Joomla 6.

Which method fits your Joomla setup

Your setup	How to get the certificate	Roughly how long
Managed or cPanel host with AutoSSL	Issue the free certificate in the panel, then set Force HTTPS	10 minutes
A host with no SSL tool, or your own VPS	Certbot for a Let’s Encrypt certificate, then set Force HTTPS	20 minutes
Paid certificate (OV, EV or wildcard)	Generate a CSR, install manually, then set Force HTTPS	30 minutes plus validation
Cloudflare in front of your site	Certificate on the origin, Cloudflare set to Full (strict), and Behind Load Balancer switched on	15 minutes

Take a backup before you start. Akeeba Backup is the usual choice on Joomla. The failure mode of this procedure is losing access to your own administrator, and a backup plus the recovery step in the configuration.php section below will get you out of it.

Which SSL certificate should a Joomla site use?

Start with the free option. Most hosts issue free Let’s Encrypt certificates automatically, and the encryption a free certificate provides is identical to a paid one. What differs between one Joomla SSL certificate and another is what the certificate authority verified before issuing it, and what you get when something goes wrong.

Type	What the CA checks	Issued in	Fits
Domain Validation (DV)	That you control the domain	Minutes	Blogs, brochure sites, most Joomla installs
Organization Validation (OV)	The domain plus your registered organization	1 to 3 business days	Business sites, member areas, client portals
Extended Validation (EV)	A full legal and operational check of the company	1 to 3 business days	Stores, finance, anywhere identity matters

If your Joomla install serves subdomains, a wildcard certificate covers them all with one certificate. Not sure which type applies? The SSL Wizard narrows it down in a few questions.

A free certificate stops being the right answer in four cases: you take payments and want a warranty behind the certificate, you need your verified organization details inside it rather than just domain control, you run subdomains and free wildcard issuance is awkward on your host, or your host does not automate renewal. That last one matters more than people expect, and the next section explains why.

Get the certificate onto your server

Joomla does not install certificates. This step happens on the server, before you touch Joomla at all.

From your hosting panel

Look for SSL/TLS, Let’s Encrypt or AutoSSL in your control panel. On cPanel it sits under Security. Issue the certificate for both the apex domain and the www version, or whichever one you missed will throw a name mismatch warning.

Let’s Encrypt certificates last 90 days and are meant to renew automatically about 30 days before expiry. When that automation breaks, usually after a domain move or a DNS change, the site keeps working for weeks and then goes insecure without warning. Confirm auto-renewal is switched on, and after the first expected renewal date, check the certificate with the SSL Checker. If the expiry date moved forward, renewal is working.

On a VPS with no panel

Use Certbot, the Let’s Encrypt client. It issues the certificate from the command line, configures Apache or Nginx, and installs its own renewal timer.

Installing a paid certificate manually

• Generate a CSR. Joomla has no CSR function of its own, so use the CSR generator, or the CSR guides for your server.
• Submit it to the certificate authority and complete validation.
• Install the certificate, the private key and the intermediate certificates. In cPanel this is SSL/TLS > Manage SSL sites, covered in the cPanel installation guide. Other platforms are in the SSL installation guides.
• Verify before moving on. Run the SSL Checker, and see how to check the certificate is installed correctly if anything looks off.

Do not skip the intermediate certificates. Install the main certificate without the chain and most desktop browsers still show a padlock, because they cache intermediates they have seen elsewhere. Mobile browsers, payment gateways and API clients will fail. If a chain problem is what you are chasing, see expired intermediate certificates.

How to force HTTPS in Joomla

With a working certificate on the server, tell Joomla to use it. Log into the administrator and go to System > Global Configuration > Server. In the Server block at the top of that tab you will find Force HTTPS, and it has three states rather than a simple on and off.

• None. Joomla does nothing. Pages remain reachable over both HTTP and HTTPS.
• Administrator Only. The administrator, its login screen included, is forced onto HTTPS, and the public site is left alone. This is the state to use while a certificate is still validating, or on a site you are migrating in stages. Your own password stops travelling in the clear immediately, without touching anything visitors see.
• Entire Site. Everything is forced onto HTTPS. This is what you want once the certificate is confirmed working.

Select Entire Site and save. Verify the certificate resolves on your domain before you do this. If Force HTTPS is enabled while the certificate is broken or missing, the administrator becomes unreachable too, and you will need the recovery step below.

These instructions target Joomla 5 and Joomla 6, the two supported branches. Joomla 6.0 shipped in October 2025, and Joomla 5 stops receiving functional updates on 13 October 2026, after which it is security patches only until October 2027. If you are still on Joomla 3, it reached end of life in August 2023 and the setting sits in a different place, so update before following anything here.

Set Force HTTPS from configuration.php

Every setting in Global Configuration is stored in configuration.php in your Joomla root. Editing that file over FTP is how you get back in when Force HTTPS has locked you out of the administrator, which is exactly the situation where the dropdown is no longer reachable.

The relevant line is:

public $force_ssl = 2;

The values map onto the three states: 0 is None, 1 is Administrator, and 2 is both the site and the administrator. Setting it back to 0 over FTP undoes a lockout in seconds.

You will find a second line nearby:

public $live_site = '';

A lot of Joomla HTTPS tutorials tell you to fill this in with your https address, and many of them write it as var $live_site. That syntax belongs to Joomla 1.5, which used PHP 4 class syntax and was retired in 2012. Current Joomla uses public, and the setting is documented as optional. Leave it empty unless you have a specific reason to pin the site URL. It is not what enables HTTPS, and setting it incorrectly is a common way to break a Joomla site. $force_ssl is the setting that does the work.

Add a 301 redirect in .htaccess

Force HTTPS handles requests that reach Joomla. A redirect at server level is faster, because it happens before PHP runs, and it keeps working if Joomla is ever offline. On Apache that means .htaccess, and here is the part almost every guide skips.

First, rename htaccess.txt

Joomla ships the file as htaccess.txt, not .htaccess. Apache ignores it under that name. If you paste redirect rules into a file called htaccess.txt, or into an .htaccess file that does not exist yet, nothing happens and there is no error to tell you why.

• Rename htaccess.txt to .htaccess in your Joomla root. Do not edit htaccess.txt and leave it there: a Joomla update overwrites that file and your changes go with it.
• Do the rename before switching on Use URL Rewriting in Global Configuration. Enable rewriting first and Joomla starts producing URLs without index.php that Apache does not know how to route, so every page except the home page returns 404.

Then add the redirect

Add these lines near the top of .htaccess, above Joomla’s own rewrite block:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Two details decide whether this works. The condition has to be off, meaning “redirect when the request is not already secure”. Written as on, which appears in a surprising number of published snippets, the rule fires only on requests that are already HTTPS and sends them to HTTPS again, which is a loop. And the R=301 flag is what makes it a permanent redirect. Without it, or with a bare R, you get a temporary 302 or an internal rewrite that never tells search engines anything moved.

On Nginx

Nginx has no .htaccess and does not read Apache rewrite rules. Edit the server block instead:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Test with nginx -t, then reload with systemctl reload nginx.

Fix what the switch leaves behind

Clear the Joomla cache. This is the first thing to do and the one most often forgotten. Joomla will happily keep serving cached pages full of HTTP markup, which makes a finished migration look broken. Go to System > Clear Cache, in the Maintenance panel, and purge your CDN as well if you use one.

Fix mixed content. A page served over HTTPS that still loads an image, script or stylesheet over HTTP is mixed content. Browsers treat the two categories differently: media is usually upgradable, so the browser quietly requests it over HTTPS instead, while scripts and stylesheets are blockable and simply refused, which is why an affected page can arrive completely unstyled. On Joomla the usual sources are hardcoded URLs in template overrides, module settings and third-party extensions. The browser console names the offending resource. Our guide on how to fix mixed content covers the diagnosis in full.

Update your sitemap and robots.txt. Regenerate the XML sitemap so it lists https URLs, and check that robots.txt does not reference the http version of anything.

Troubleshooting Joomla SSL problems

Too many redirects after enabling Force HTTPS

This is the most common Joomla HTTPS failure, and it happens because two pieces of standard advice are incompatible. If a proxy such as Cloudflare terminates TLS and then talks to your server over plain HTTP, Joomla never sees an HTTPS request. Force HTTPS concludes the visitor arrived insecurely and redirects them to HTTPS, the proxy answers that request over HTTP again, and the loop continues until the browser gives up with ERR_TOO_MANY_REDIRECTS.

There are two fixes and you generally want both:

• Set your Cloudflare SSL/TLS encryption mode to Full (strict) and keep a valid certificate on the origin server. The Flexible mode, which several popular Joomla tutorials still recommend as the quick free option, is what creates the loop.
• Switch Behind Load Balancer to Yes. It is on the same System > Global Configuration > Server tab, further down in the Proxy block. This tells Joomla to trust the forwarded protocol header from the proxy instead of looking for a direct HTTPS connection.

One caution on that second setting: only enable Behind Load Balancer if your site really is behind a proxy, load balancer or CDN. On an ordinary host, trusting a forwarded header that anyone can send weakens security for no benefit.

Other common problems

Symptom	Cause	Fix
Locked out of the administrator	Force HTTPS enabled while the certificate is missing or broken	Set $force_ssl to 0 in configuration.php over FTP, fix the certificate, then re-enable
The redirect rules do nothing	They were written into htaccess.txt, or into an .htaccess file that does not exist	Rename htaccess.txt to .htaccess
Every page except the home page returns 404	URL Rewriting was switched on before the rename	Rename the file, or turn rewriting off until you have
Padlock missing on some pages only	Mixed content on those pages	Find the HTTP resource in the browser console
Site was fine, went insecure weeks later	A Let’s Encrypt certificate expired because renewal broke	Reissue, then confirm auto-renewal in your panel
Works in a browser, fails for an app or gateway	Incomplete certificate chain	Install the full CA bundle, recheck with the SSL Checker
Name mismatch on www or the apex	The certificate covers only one of the two names	Reissue covering both. See common name invalid

If the certificate is installed and the site still reports as insecure, the SSL error guides handle specific browser error codes.

After the switch: SEO checklist

• Add the HTTPS property in Google Search Console. An HTTP property does not report on HTTPS URLs. Add the new one, or use a Domain property, which covers both.
• Resubmit the sitemap with https URLs.
• Check canonical tags point at https in your SEF or SEO extension.
• Update analytics and any third-party service that stores your site URL.

Expect some movement. Google treats an HTTP to HTTPS switch as a site move with URL changes, so impressions will appear split across your HTTP and HTTPS properties for a while and rankings often fluctuate for a few weeks before settling. As long as every page resolves and the 301 redirects are in place, there is nothing to fix.

Once HTTPS has been stable for a while, consider HSTS, which tells browsers to refuse plain HTTP for your domain outright. Leave the preload directive off at first, because it is slow to reverse and will make any subdomain still on HTTP unreachable.

Frequently Asked Questions

Moving a different platform, or want the general procedure? See our guide on how to switch a site from HTTP to HTTPS.